İçeriğe geç
Bilgi ve Teknoloji Uygulamada aç

Kritik CVSS 9.8

CVE-2017-5645: Log4j: güvenilmeyen verinin serileştirmeden çıkarılması

Yayın: · Güncelleme:

Açıklama (NVD)

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

Özet bilgiler

Ürün
Apache Log4j
CVSS v3.1
9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
%89,36 (yüzdelik 100)
CWE
CWE-502
Yama
Mevcut

Etkilenen sürümler

ÜrünBaşlangıçBitişDüzeltildi
apache-log4j2.0—2.8.2
netapp-oncommand-api-services———
netapp-oncommand-insight———
netapp-oncommand-workflow-automation———
netapp-service-level-manager———
netapp-snapcenter———
netapp-storage-automation-store———
redhat-fuse1.01.0—
redhat-enterprise-linux6.06.0—
redhat-enterprise-linux6.76.7—
redhat-enterprise-linux7.07.0—
redhat-enterprise-linux7.37.3—
redhat-enterprise-linux7.47.4—
redhat-enterprise-linux7.57.5—
redhat-enterprise-linux7.67.6—
redhat-enterprise-linux-desktop7.07.0—
redhat-enterprise-linux-server7.07.0—
redhat-enterprise-linux-server-aus7.47.4—
redhat-enterprise-linux-server-aus7.67.6—
redhat-enterprise-linux-server-eus7.47.4—
redhat-enterprise-linux-server-eus7.57.5—
redhat-enterprise-linux-server-eus7.67.6—
redhat-enterprise-linux-server-tus7.47.4—
redhat-enterprise-linux-server-tus7.67.6—
redhat-enterprise-linux-workstation7.07.0—
oracle-api-gateway11.1.2.4.011.1.2.4.0—
oracle-application-testing-suite13.3.0.113.3.0.1—
oracle-autovue-vuelink-integration21.0.021.0.0—
oracle-autovue-vuelink-integration21.0.121.0.1—
oracle-banking-platform2.6.02.6.0—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları